Java Security

I�m trying to get a grip about the security model for J2EE applications.
Today im working on a webapplication where I want to be able to restrict resources via declaritve or programatically access to any resource defined (files, webpages, methods.)
We use a LDAP directory for authentication (Novell eDirectory) but today we just initialize a user object that does�nt conform to the security model of J2EE.
I understand (hopefully) that our authenticated user should be represented of a object of type java.security.Principal, but how do i associate a custom Principal object with the Http request that the user invokes?

Niclas